2.6.38-stable review patch. If anyone has any objections, please let us know.

------------------From: Eric Paris <eparis@redhat.com>

commit d0de4dc584ec6aa3b26fffea320a8457827768fc upstream.

On an error path in inotify_init1 a normal user can trigger a doublefree of struct user. This is a regression introduced by a2ae4cc9a16e("inotify: stop kernel memory leak on file creation failure").

We fix this by making sure that if a group exists the user reference isdropped when the group is cleaned up. We should not explictly drop thereference on error and also drop the reference when the group is cleanedup.

The new lifetime rules are that an inotify group lives frominotify_new_group to the last fsnotify_put_group. Since the struct userand inotify_devs are directly tied to this lifetime they are onlychanged/updated in those two locations. We get rid of all specialcasing of struct user or user->inotify_devs.